| FRC — Corporate Governance Code Guidance, risk appetite ↗ | Set risk appetite people can actually use
From a control list to board assurance
| 1 November 2026 |
| HM Treasury — current Orange Book collection and update history ↗ | Set risk appetite people can actually use
Test controls and keep an evidence trail
| 1 November 2026 |
| Companies Act 2006 — section 172 ↗ | Record a board decision that can be explained
| 1 November 2026 |
| Companies Act 2006 — section 174 ↗ | Record a board decision that can be explained
| 1 November 2026 |
| Companies Act 2006 — section 248, directors’ meeting records ↗ | Record a board decision that can be explained
| 1 November 2026 |
| Companies House — being a company director ↗ | Record a board decision that can be explained
| 1 November 2026 |
| FRC — UK Corporate Governance Code 2024 ↗ | From a control list to board assurance
Provision 29: prepare the evidence before the reporting date
| 1 November 2026 |
| FRC — Wates Principles for large private companies ↗ | Give every policy an owner and a review path
| 1 November 2026 |
| Companies House — director responsibilities ↗ | Give every policy an owner and a review path
| 1 November 2026 |
| ECCTA 2023 — section 199, failure to prevent fraud ↗ | Fraud prevention: scope before templates
Fraud prevention: review the process in operation
| 1 November 2026 |
| ECCTA 2023 — section 201, large organisations ↗ | Fraud prevention: scope before templates
| 1 November 2026 |
| Home Office — guidance on the offence of failure to prevent fraud ↗ | Fraud prevention: scope before templates
Fraud prevention: review the process in operation
| 1 November 2026 |
| FRC — Code scope, commencement and Provision 29 questions ↗ | Provision 29: prepare the evidence before the reporting date
| 1 November 2026 |
| HM Treasury — The Orange Book: Management of Risk ↗ | Build a risk register that supports decisions
| 1 November 2026 |
| NCSC — Risk management for cyber security ↗ | Build a risk register that supports decisions
| 1 November 2026 |
| HM Treasury — Quick Guide to the Central Government's Assurance Directory ↗ | Test controls and keep an evidence trail
| 1 November 2026 |
| NCSC — Principles of supply-chain security ↗ | Review suppliers across the whole relationship
| 1 November 2026 |
| NCSC — Assess and gain confidence in supply-chain cyber security ↗ | Review suppliers across the whole relationship
| 1 November 2026 |
| NCSC — Embed cyber security controls throughout the contract's duration ↗ | Review suppliers across the whole relationship
| 1 November 2026 |
| NCSC — Exercise in a Box ↗ | Practise disruption before it becomes a crisis
| 1 November 2026 |
| NCSC — Effective steps to cyber exercise creation ↗ | Practise disruption before it becomes a crisis
| 1 November 2026 |
| NCSC — 10 Steps: Incident management ↗ | Practise disruption before it becomes a crisis
| 1 November 2026 |
| UK Government — Cyber Governance Code of Practice ↗ | Bring cyber risk into the board's decisions
| 1 November 2026 |
| UK Government — Code launch and purpose ↗ | Bring cyber risk into the board's decisions
| 1 November 2026 |
| NCSC — Cyber Security Toolkit for Boards ↗ | Bring cyber risk into the board's decisions
| 1 November 2026 |
| NCSC — 10 Steps: Risk management ↗ | Bring cyber risk into the board's decisions
| 1 November 2026 |
| FCA — Operational resilience: insights and observations one year on (27 March 2026) ↗ | Operational resilience after the transition deadline
| 1 November 2026 |
| FCA — Operational resilience: scope and requirements ↗ | Operational resilience after the transition deadline
| 1 November 2026 |
| FCA — Operational resilience insights and observations (28 May 2024) ↗ | Operational resilience after the transition deadline
| 1 November 2026 |
| FCA — Regulatory Initiatives Grid, May 2026 edition and scope ↗ | Build an obligations register that changes the work
| 1 November 2026 |
| ICO — Leadership and oversight ↗ | Build an obligations register that changes the work
The accountability review: what evidence should the board see?
| 1 November 2026 |
| ICO — Guide to accountability and governance ↗ | UK GDPR accountability and DPIA triage
| 1 November 2026 |
| ICO — Data protection impact assessments ↗ | UK GDPR accountability and DPIA triage
| 1 November 2026 |
| ICO — Data protection audit framework and audience ↗ | UK GDPR accountability and DPIA triage
The accountability review: what evidence should the board see?
| 1 November 2026 |
| Money Laundering Regulations 2017 — scope, risk assessment, controls and audit ↗ | AML scope and assurance: start with the activity
| 1 November 2026 |
| FCA — Money laundering and terrorist financing ↗ | AML scope and assurance: start with the activity
| 1 November 2026 |
| UK GDPR Article 33 — notification of a personal data breach ↗ | Incident and personal data breach escalation
| 1 November 2026 |
| ICO — Personal data breaches: a guide ↗ | Incident and personal data breach escalation
| 1 November 2026 |
| ICO — Breach response and monitoring ↗ | Incident and personal data breach escalation
| 1 November 2026 |
| Money Laundering Regulations 2017 — regulation 24 training ↗ | Training and monitoring that test understanding
| 1 November 2026 |
| ICO — Training and awareness ↗ | Training and monitoring that test understanding
| 1 November 2026 |
| ICO — Monitoring and reporting on training completion ↗ | Training and monitoring that test understanding
| 1 November 2026 |
| FCA Financial Crime Guide — systems and controls ↗ | Training and monitoring that test understanding
| 1 November 2026 |
| ICO — Accountability toolkit ↗ | The accountability review: what evidence should the board see?
| 1 November 2026 |
| Data (Use and Access) Act 2025 — Commencement No. 6 Regulations 2026 ↗ | After commencement: turn data protection reform into controlled change
| 1 November 2026 |
| ICO — What DUAA means for organisations, updated 19 June 2026 ↗ | After commencement: turn data protection reform into controlled change
| 1 November 2026 |
| GOV.UK — Data protection and privacy changes ↗ | After commencement: turn data protection reform into controlled change
| 1 November 2026 |
| FRC — revised ISA (UK) 250 and ISA (UK) 270 announcement ↗ | FRC revises auditing standards for legal and regulatory non-compliance
| 1 November 2026 |
| NCSC — From industry concern to practical action: the value of working with regulators ↗ | NCSC highlights how cyber incident sharing can meet market disclosure duties
| 1 November 2026 |
| FCA — Primary Market Bulletin 66, section 4 on cyber incidents ↗ | NCSC highlights how cyber incident sharing can meet market disclosure duties
| 1 November 2026 |
| FCA — CP26/37: Senior Managers and Certification Regime (SM&CR) Review: Phase 2 ↗ | FCA consults on a second phase of SM&CR reforms
| 1 November 2026 |